What if someone steals the AI box? Two questions: can the thief read it, and what must the office do next?
Short answer. A stolen AI box is two problems: whether the thief can read what is on it, and what the office must do. Readability depends on disk encryption and on how the key is released. NIST notes that full-disk encryption protects a computer that is not booted, provided pre-boot authentication is required, and gives no protection once it is booted. The next steps are to report the theft, revoke every credential the box held, restore onto a replacement from backup, and assess whether personal data was exposed. The DPDP Act’s definition of a personal data breach covers unauthorised processing and loss of access that compromises confidentiality, integrity or availability, so a theft needs to be assessed against it.
01
The first hour
Note when you found the box missing, keep door logs and camera footage, and tell the person responsible for AI at once.
Report the theft to the police and keep the reference for your records and any insurance claim.
Revoke what the box could use: API keys, connector tokens (for example to Google Workspace or Zoho), VPN credentials, certificates and any passwords stored on it. Change the administrator passwords of systems it could reach.
End user sessions and reset passwords if accounts or password hashes lived on the box.
Check that your backups are intact and kept offline, then plan the rebuild on a replacement.
Start a written record: what was on the box, whether the disk was encrypted, who was told and when.
Take advice on reporting duties the same day (see below).
02
Can the thief read the data?
Set-up
What a thief holding the box can do
Trade-off
No disk encryption
Read everything by removing the drive or starting from a USB stick
None, which is the problem
Encryption, key sealed to the machine (TPM only)
Usually reach the sign-in screen with the disk already decrypted, so only the sign-in stands in the way
Restarts without a person. Microsoft calls this more convenient but less secure than options with a second factor, and says bypassing it can be done for a reasonable cost on some systems
Encryption with a PIN or passphrase at start-up
Cannot read the disk without the secret
Someone must enter it after every restart, which clashes with unattended recovery after a power cut
Encryption, key released by a server on the office network
Cannot boot the machine away from the office network
Needs a key server that is itself protected and available. Microsoft documents a network-based key release for BitLocker
03
What NIST says about full-disk encryption
NIST SP 800-111 says that for a computer that is not booted, everything encrypted by full-disk encryption is protected, assuming pre-boot authentication is required. When the device is booted, the encryption provides no protection, and the operating system becomes fully responsible for the unencrypted information.
That leaves a design choice to make on purpose and write down. A box that restarts by itself after a power cut cannot ask a person for a passphrase. Ask how the key is released, and what protects the box if it is started in a stranger’s hands.
04
Reporting duties: general information, not legal advice
CERT-In’s directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate and government organisations to report listed cyber incidents within six hours of noticing them. The list includes unauthorised access to IT systems or data, data breach and data leak. CERT-In’s FAQ explains a data breach as information stolen or taken from a system without the knowledge or authorisation of its owner. Whether a stolen device is a reportable incident for your office is a question for your advisers.
Under the DPDP Act a data fiduciary must give the Data Protection Board and each affected person intimation of a personal data breach (section 8(6)). The Rules, once in force, say the Board is to be told without delay and given a detailed report within 72 hours, or a longer period the Board allows. Affected people are to be told without delay, in plain words, with the consequences, the steps taken and a contact. As of October 2026 those rules are not yet in force.
05
Make theft harder
Keep the box in a lockable room or cabinet. NIST’s server guide lists locks, card readers, guards and intrusion detection as examples of physical protection to consider.
Fit a cable lock or anchor. It slows a grab-and-go, but it does not replace encryption.
Record the serial number and fit an asset tag.
Limit who holds keys, and keep a record of who has them.
Do not site the box where visitors or delivery staff pass.
06
What ANVE says
ANVE keeps the office’s data on the box in the office, so a stolen box is a data question as well as an equipment loss. Everything sits in one database on the box, and full-disk encryption and secure boot are part of the appliance image, which is not on ANVE yet (see /security). How the key is released at start-up is not stated here. No sealed ANVE unit exists yet: the software runs today on a development machine. ANVEAI confirms the key handling in writing before a paid pilot. Ask whether the box restarts unattended after a power cut, and what that implies for the key.
07
Questions people ask
Can we wipe a stolen box remotely?
Only if the machine can be reached. A remote wipe needs the box to contact a management service, and a thief will usually keep it offline. That is why disk encryption, rather than remote wipe, is the main defence for an on-premise box.
Is a stolen box automatically a personal data breach?
Not automatically. It depends on what was on the box and whether it could be read. The Act’s definition turns on unauthorised processing and loss of access that compromises confidentiality, integrity or availability. Take advice and record your reasoning.
Is a cable lock enough?
No. A cable lock or anchor makes a snatch harder, and it costs little, but a determined thief can defeat it. Encryption and a locked room are what protect the data.
08
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
